1. Field of the Invention
The present invention relates to an image forming apparatus, a security policy setting method according to the image forming apparatus, and a computer program, and is especially useful for setting a security policy in the network environment.
2. Description of the Related Art
It is desirable that a personal computer (PC) and server devices (a file server, an authentication server, and the like) to be connected to a network in an office are operated in accordance with an information security policy defined by each office. The information security policy is a basic policy regarding the information security of the whole enterprise and is a collection of policies for utilizing information and for preventing invasion from the outside and information leakage, which is developed by an administrator dealing with the security.
The device to be connected to the network in the office includes a peripheral device such as a multifunction peripheral in addition to the above-described PC and server device. The recent multifunction peripheral has functions not only for simply printing and transmitting an image but also for storing image data in the multifunction peripheral and providing a file service to the PC. Therefore, the multifunction peripheral becomes able to play a role similar to other server devices existing on the network. In addition, a development environment of an application to be installed in the multifunction peripheral has been disclosed recently, and an application developed by a manufacturer different from that of the multifunction peripheral is used in the multifunction peripheral as in the case with the PC.
Maintenance of a safe and secure office environment requires the multifunction peripheral to comply with the information security policy as with the PC and the server device. The term “comply with the information security policy” here means that limitations are placed on operations regarding security, such that user authentication is essential to operate the multifunction peripheral, in order to prevent an unjustified use of the multifunction peripheral in the office and information leakage.
In order to comply with the information security policy, there is a method that a delivery server collectively sets setting values depending on an operating system (OS), (hereinbelow, referred to as a security policy) and collectively delivers the set security policy to each device. In addition to the method for collectively delivering the security policy from the delivery server, the security policy can be individually set by accessing the device from a browser screen of the PC.
As a technique for setting a security policy, there is a technique discussed in Japanese Patent Application Laid-Open No. 2011-4117. Japanese Patent Application Laid-Open No. 2011-4117 suggests the technique, if there is a job which is against a security policy when the security policy is enabled, for performing processing with respect to the job so as to meet the security policy.
There may be a case that a security policy for “prohibiting use of a weak cryptography” is set to a multifunction peripheral to enhance its safety. If such security policy for “prohibiting use of a weak cryptography” can be applied to the multifunction peripheral, peripheral devices such as the multifunction peripheral cannot perform communication using an encryption key and a certificate going against to the security policy.